Security1 hOctober 24, 2026, 23:39

PHP 8.5.12 patches two unauthenticated critical RCE bugs

The PHP team released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two unauthenticated RCE flaws: CVE-2026-109618 (memory corruption on out-of-memory bailout) and CVE-2026-109619 (stale global state leaking between requests). PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed are affected, with a demonstrated mod_php exploit that runs before application code.

DEV Community

Open source

PHP 8.5.12 patches two unauthenticated critical RCE bugs

CVE-2026-109618: RCE via corruption during out-of-memory bailout
CVE-2026-109619: RCE via stale global state across requests
Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35; no updates for 8.1 and older
Restarting FPM workers is required after the package update

#PHP

Google paid $90,000 for a DevSite RCE bug, then took two months to patch it

Security

Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws

Security

SolarWinds Patches Two Critical RCE Flaws in Observability Self-Hosted

Security

PHP 8.5.12 patches two unauthenticated critical RCE bugs

Google paid $90,000 for a DevSite RCE bug, then took two months to patch it

Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws

SolarWinds Patches Two Critical RCE Flaws in Observability Self-Hosted

Patches released for critical RCE flaws in PHP, GitLab and Node.js